package com.micro.gateway.filter;

import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
import org.springframework.http.HttpStatus;
import org.springframework.stereotype.Component;
import org.springframework.web.server.ServerWebExchange;
import org.springframework.web.server.WebFilter;
import org.springframework.web.server.WebFilterChain;
import reactor.core.publisher.Mono;

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class ForceCorsFilter implements WebFilter {

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
        // 获取请求头
        HttpHeaders headers = exchange.getRequest().getHeaders();
        String origin = headers.getFirst(HttpHeaders.ORIGIN);
        
        // 检查是否是预检请求
        if (HttpMethod.OPTIONS.equals(exchange.getRequest().getMethod())) {
            // 预检请求处理 - 强制设置 CORS 头
            exchange.getResponse().setStatusCode(HttpStatus.OK);
            
            // 清除所有可能存在的 CORS 头
            exchange.getResponse().getHeaders().remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN);
            exchange.getResponse().getHeaders().remove(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS);
            exchange.getResponse().getHeaders().remove(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS);
            exchange.getResponse().getHeaders().remove(HttpHeaders.ACCESS_CONTROL_MAX_AGE);
            exchange.getResponse().getHeaders().remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS);
            exchange.getResponse().getHeaders().remove(HttpHeaders.ACCESS_CONTROL_EXPOSE_HEADERS);
            
            // 强制设置正确的 CORS 头
            exchange.getResponse().getHeaders().add(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "http://localhost:5173");
            exchange.getResponse().getHeaders().add(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS");
            exchange.getResponse().getHeaders().add(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "Content-Type, Authorization, X-Requested-With, Accept, Origin, X-Requested-With, Cache-Control");
            exchange.getResponse().getHeaders().add(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");
            exchange.getResponse().getHeaders().add(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
            
            return exchange.getResponse().setComplete();
        }
        
        // 普通请求处理 - 强制设置 CORS 头
        if (origin != null && origin.equals("http://localhost:5173")) {
            // 清除所有可能存在的 CORS 头
            exchange.getResponse().getHeaders().remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN);
            exchange.getResponse().getHeaders().remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS);
            
            // 强制设置正确的 CORS 头
            exchange.getResponse().getHeaders().add(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "http://localhost:5173");
            exchange.getResponse().getHeaders().add(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
        }
        
        return chain.filter(exchange);
    }
}
